fa695a20d4245f05781b02bcf7595643c0d0627c6499297086411226c83ac779

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 21:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_7640e2ea3b03a85d268afb4656ddb59a_amadey_elex_smoke-loader.exe
Size 3.6MB
Sample260826-zy79natxax
SHA256 fa695a20d4245f05781b02bcf7595643c0d0627c6499297086411226c83ac779
MD5 7640e2ea3b03a85d268afb4656ddb59a
SHA1 2c300131bde3d9054309c40154fdf84ce070803e
SHA512 63764d7d650e633e15637d435925cf4f7434975ae729706198278ef76b5a998917c30495b81661d0e81cad3dca2b35db4a25b6ac46f17c178b5f71fa86a13d6d
SSDEEP 98304:/mSWOiIyUMVkbLp8jvWhfyVLUjH5oxFbx:/XKVkp+e1yVUjZEd
TLSH
T1E0060153F7818AE4C24D4576AB514285922EFA21AA0F63523A8C130DCF977C78F66F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2064	1EF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_7640e2ea3b03a85d268afb4656ddb59a_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1EF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 2064	5032	2026-08-25_7640e2ea3b03a85d268afb4656ddb59a_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-25_7640e2ea3b03a85d268afb4656ddb59a_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_7640e2ea3b03a85d268afb4656ddb59a_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Users\Admin\AppData\Local\Temp\1EF.tmp
  "C:\Users\Admin\AppData\Local\Temp\1EF.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-25_7640e2ea3b03a85d268afb4656ddb59a_amadey_elex_smoke-loader.exe 9BEC03D79C96BB3717A5DF59BC9457AD69A0C4C58CCE38E6D890EF90ADFD658687B649859D93502B5687648EF2BE32D20507B1AE1EBE05CFAC16E1751B637108
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1EF.tmp

Path C:\Users\Admin\AppData\Local\Temp\1EF.tmp
Size 3.6MB
SHA256 881eb0ae445dcc1a67d2671fc4a4164f2e5e2fbf44c74fd1f7d7499bb57191a8
MD5 203a79d4087a9e496d5348da8c76eabd
SHA1 515216dc2182af81691f1522fa5165e8d29d6b99
SHA512 72d00723dec03990689131ce5df871ca2952bf99ec183b2e0cb3323fb4e05ae068dd7a1fa3ad4589acdc14ba803c9061e65950bf0ba1016872f5c453e910de87
SSDEEP 98304:/mSWOiIyUYSfH6z0dtaHJfvMHu6HVLUjH5oxFbx:/X2SfH6odU7UVUjZEd
TLSH
T181060143F7818AE4C24D45BA6F514285922EF922AA0F53527E8C131DCF977878F26E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download